Compute Engine has several predefined IAM roles. Let's look at three of these. The compute admin role provides full control of all Compute Engine resources. This includes all permissions that starts with compute, which means that every action for any type of Compute Engine resource is permitted. The network admin role contains permissions to create, modify, and delete networking resources except for firewall rules and SSL certificates. In other words, the network admin role allows read-only access to firewall rules, SSL certificates, and instances to view their ephemeral IP addresses. The storage admin role contains permissions to create, modify, and delete disks, images and snapshots. For example, is your company has someone who manages projects images, and you don't want them to have editor role on the project, render account the storage admin role on the project. Roles are meant to represent abstract functions and are customized to align with real jobs. But what if one of these roles do not have enough permissions or you need something even finer grained? That's what custom roles permits. A lot of companies use a least privileged model in which each person in your organization has the minimal amount of privilege needed to do his or her job. So for example, maybe I want to define an instance operator role to allow some users to stop and start Compute Engine virtual machines, but not reconfigure them. Custom roles allows me to do that. A couple of cautions about custom roles. First, if you decide to use custom roles, you need to manage the permissions that make them up. Some companies decided that rather stick with predefined roles. Second, custom roles can only be used at the project or organizational level, they can't be used at the folder level. Remember that when you give a user, group or service account, a role on a specific element of the resource hierarchy, the resulting policy applies to the element you chose, as well as the elements below that in the hierarchy.
